Vercel React2Shell WAF bypass challenge: five parser-differential bypasses of CVE-2025-55182 protections found by Hacktron
Researchers at Hacktron (author ginoah) described five bypasses of the Vercel WAF rules protecting against React2Shell (CVE-2025-55182), a pre-auth RCE in React Server Functions affecting Next.js 15.x–16.0.6 and other React-based frameworks. The bypasses were found during a Vercel bounty challenge. Per Vercel's writeup, 116 researchers to…